k8s.io/utils/exec.CodeExitError was the only remaining direct use of
k8s.io/utils. Replace it with a local error type implementing the same
interface. The streaming server uses this interface to distinguish commands
terminating with a non-zero exit status from errors executing the
command, and to propagate the exit status to the client.
Add a FIXME to define this error contract in k8s.io/cri-streaming,
where it is consumed, instead of requiring runtime implementations
to implicitly match k8s.io/utils/exec.ExitError.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- Populate the NRI container's Image field from the image identity recorded in the container metadata at creation, so plugins can identify and verify the container's image by digest. The following fields have been added:
- name: The image reference (ex. registry.k8s.io/pause:3.10)
- digest: Digest the image reference resolves to. Based on the image reference, it is a digest of one of:
- image index
- OCI: application/vnd.oci.image.index.v1+json
- Docker: application/vnd.docker.distribution.manifest.list.v2+json
- manifest
- OCI: application/vnd.oci.image.manifest.v1+json
- Docker: application/vnd.docker.distribution.manifest.v2+json
- config_digest: The image configuration digest
- OCI: application/vnd.oci.image.config.v1+json
- Docker: application/vnd.docker.container.image.v1+json
Signed-off-by: Eshaan Mathur <eshaanm25@gmail.com>
The container_start_time_seconds metric was reporting nanoseconds
instead of Unix seconds. The CRI container status stores StartedAt
as nanoseconds (per the CRI API spec), but the metric name and help
text indicate seconds. Convert by dividing by time.Second.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
When collectContainerMetrics fails for a single container, the
goroutine was returning nil which exited the loop entirely. The
sandbox metrics, including pod-level network metrics and any
successfully collected container metrics, were never appended to
the response.
Replace return nil with continue so that individual container
failures only skip that container.
Signed-off-by: Damien Grisonnet <dgrisonn@redhat.com>
Remove support for restoring checkpoint data during CreateContainer,
which was previously deprecated in v2.3.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Drop internal/cri/seutil/seutil.go in favor of direct call to newly
introduced selinux.SetProcessKind.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Add server-streaming variants of CRI list RPCs (StreamContainers,
StreamPodSandboxes, StreamContainerStats, StreamPodSandboxStats,
StreamPodSandboxMetrics, StreamImages) that send results in batches
of 5000 items.
Signed-off-by: Ayato Tokubi <atokubi@redhat.com>
Add a new `enable_criu` configuration option under CRI plugin runtime
settings. When set to false, any checkpoint or restore request will fail
fast with an error indicating that CRIU support is disabled by
configuration. `enable_criu` currently defaults to true.
Add an integration test script to verify that setting `enable_criu` to
false in containerd configuration successfully disables checkpoint and
restore operations and fails fast.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Perform an early validation check on both container checkpoint and
restore paths to fail-fast if the CRIU binary is missing or is older
than the minimum required version (3.16.0).
To support runtime-configured environments, the validation respects the
custom PATH from the shim manager environment if configured, skipping
any relative paths to avoid incorrect daemon-relative resolution. If not
configured, it falls back to a standard system PATH lookup. The check
result is cached using sync.Once to prevent redundant process spawning.
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
introspectRuntimeFeatures returned an error for any runtime type other
than io.containerd.runc.v2, so non-runc shims such as
containerd-shim-runsc-v1 never had their OCI features surfaced to the
CRI RuntimeHandlerFeatures, even though they implement the shim "-info"
command.
The runc-only guard worked around a nil-pointer panic when marshalling
nil runtime options. That case is already covered by the "if options !=
nil" check, making the guard redundant. Dropping it lets all runtimes be
introspected; shims that do not implement "-info" still fail gracefully
and are logged at debug level, so behavior for those is unchanged.
Guard against nil plugin info Extra, nil runtime Features, and nil
features.Linux before unmarshalling or evaluating CRI user namespace
support.
Signed-off-by: Amir Alavi <amiralavi7@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Address review feedback on the previous commit:
- Use MiB/s (binary, 1024^2) consistently. The divisor was already
1024*1024; the constant name (mbToByte) and the Help/comment text
mislabeled the unit.
- Keep image_pulling_throughput for backwards compatibility but mark
it Deprecated. Its prom.DefBuckets top out at 10 MiB/s, which
saturates almost immediately on modern hardware.
- Add image_pulling_throughput_mibps with buckets covering 0.1 MiB/s
through 4000 MiB/s (~31 Gbps), enough for 10G+ NICs. Above that,
disk write throughput becomes the bottleneck rather than the
network, so finer buckets aren't worth the cardinality.
- Both metrics observe the same value (fetched bytes / pull duration,
cached layers excluded; fully-cached pulls skipped). Only the
buckets and deprecation status differ.
Signed-off-by: Ahmet Alp Balkan <ahmet@linkedin.com>
The image_pulling_throughput histogram divided the full image size (all
layers plus config) by wall-clock pull duration. Layers already present
in the content store were counted in the numerator, so the reported
MB/s came out way higher than what was actually fetched. Fully-cached
pulls were the worst case: they "pulled" in milliseconds but reported
the full image size, showing up as huge outliers in the histogram.
Both pull paths (local client.Pull and the transfer service) already
maintain a totalBytesRead counter in pullRequestReporter for progress
and timeout checks. Cached blobs never trigger a fetch, so the counter
naturally excludes them. Plumb that value out of both helpers and use
it in place of image.Size(ctx). Fully-cached pulls (bytesPulled == 0)
are not observed, so they don't produce near-infinite samples.
Also updates the metric's Help text to say the denominator is the
end-to-end pull duration including layer extraction and snapshotter
unpack, not just network transfer.
Addresses #13244
Signed-off-by: Ahmet Alp Balkan <ahmet@linkedin.com>
Before this fix, CreateContainer would proceed even if the sandbox
had already stopped or was in an unknown state. This could result in
containers being created in an unusable sandbox, leading to confusing
errors downstream.
StartContainer already guards with the same check:
if sandbox.Status.Get().State != sandboxstore.StateReady {
return nil, fmt.Errorf("sandbox container %q is not running", ...)
}
Apply the identical guard in CreateContainer, immediately after the
sandbox state is known, so that callers receive a clear error instead
of a partial container object.
Fixes#13599
Signed-off-by: crawfordxx <crawfordxx@users.noreply.github.com>
CRImportCheckpoint built the combined environment (image env followed by
the CRI container env) into a local slice, then re-appended that slice to
imageConfig.Env, duplicating every image environment variable on the
restored container. Assign the combined slice directly instead.
Fixes#13611
Signed-off-by: Aman Raj <aman.yug@gmail.com>
The CRI checkpoint restore path unpacked checkpoint archive/OCI image content
directly into the container's persistent state directory and read files such as
container.log back from it with a symlink-following copy. Checkpoint content is
externally provided, so make restore more defensive about what it unpacks and
how it reads those files back.
Behavior changes:
- Only unpack regular files and directories from the checkpoint archive.
- Unpack checkpoint content into a dedicated <state>/ctrd-restore
subdirectory created fresh rather than into the state dir itself, so
checkpoint content cannot collide with containerd's own files (e.g.
the "status" blob). Restore and cleanup operate on that subdir;
cleanup is now a single RemoveAll of it.
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Filter out any annotations on the checkpointed container matching
`cdi.k8s.io/` or exactly `cdi.k8s.io` during restore to prevent
unauthorized device restoration. When an annotation is denied, a warning
log is generated.
Tested by:
* Unit tests for exact matching, prefix boundaries, and metadata merging
* Complete CRI integration and checkpoint restore suite
Assisted-by: Antigravity
Signed-off-by: Samuel Karp <samuelkarp@google.com>
Between starting the sandbox and adding it to the
sandbox store, there are opportunities for failures
including in any NRI RunPodSandbox prehooks. This defer
is added to that period so if they fail, this function
will try to clean it up itself. If the sandbox is
already added to the persistent store, it will not attempt
to stop the sandbox as it can now be recognized by other
components from the CRI store. ShutdownSandbox is used
instead of StopSandbox as it both stops it and cleans up
all its directories.
Signed-off-by: lauralorenz <lauralorenz@google.com>
The RunPodSandbox unconditionally pre-pulls the pause container
image via ensurePauseImageExists() before starting any sandbox.
However, only the "podsandbox" controller actually uses the pause
image to create a pause container holding namespaces. Shim-based
sandbox controllers (e.g. Kata Containers) manage the sandbox
lifecycle entirely at the shim level and never reference the pause
image.
Add a DisablePauseImagePull flag to the Runtime config that gates
ensurePauseImageExists(). When a sandboxer is not "podsandbox", the
flag skips the unnecessary pre-pull, avoiding wasted network/storage
overhead and reducing sandbox startup latency.
The long-term direction is to offload image pulling entirely to the
controller implementation (shim level); this flag is an incremental
step toward that goal without introducing a breaking behavior change.
Also add unit tests to verify that ensurePauseImageExists is only
invoked for the "podsandbox" sandboxer and correctly skipped otherwise.
Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
Mike Brown